CVE-2024-13334: Car Demon WordPress Plugin XSS Vulnerability

CVE-2024-13334 Overview

CVE-2024-13334 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Car Demon plugin for WordPress. The flaw affects all versions up to and including 1.8.1. It exists in the search_condition parameter within the plugin's search form component. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a crafted link. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed in the context of authenticated WordPress users, including administrators.

Affected Products

Car Demon plugin for WordPress — all versions ≤ 1.8.1
WordPress sites using the vulnerable search/search-form.php component
Any WordPress installation with Car Demon active and publicly reachable

Discovery Timeline

2025-01-15 - CVE-2024-13334 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13334

Vulnerability Analysis

The Car Demon plugin processes the search_condition HTTP parameter and reflects its value into the rendered search form page without sufficient sanitization or output escaping. An attacker crafts a URL containing JavaScript payloads in this parameter. When a victim loads the URL, the injected script executes within the origin of the vulnerable WordPress site.

Because the CVSS scope is changed (S:C), injected scripts can affect resources beyond the vulnerable component itself. This includes accessing session cookies, performing cross-site request forgery against authenticated sessions, and manipulating page content shown to the victim. Exploitation requires user interaction (UI:R) but no authentication, making phishing and social engineering the primary delivery methods.

Root Cause

The plugin's search-form.php file fails to apply WordPress sanitization functions such as sanitize_text_field() on input and esc_attr() or esc_html() on output for the search_condition value. The unescaped parameter is emitted directly into HTML markup, breaking the browser's parsing context and allowing attacker-supplied markup to be treated as executable script.

Attack Vector

An attacker crafts a URL targeting a vulnerable Car Demon search endpoint with a malicious search_condition payload. The attacker distributes the URL through phishing email, malicious advertisements, forum posts, or social media. When a WordPress user with an active session clicks the link, the payload executes in their browser under the site's origin. See the WordPress Plugin Code Review and the Wordfence Vulnerability Intelligence advisory for the vulnerable code path.

No verified public exploit code is available. The vulnerability is described in prose only, based on the plugin source review referenced above.

Detection Methods for CVE-2024-13334

Indicators of Compromise

HTTP requests to Car Demon search endpoints containing search_condition parameter values with <script>, javascript:, onerror=, or onload= substrings.
Web server access logs showing URL-encoded payloads such as %3Cscript%3E or %22%3E%3C within the search_condition query string.
Referrer headers pointing to external phishing domains preceding requests to the plugin's search form.
Unexpected outbound requests from user browsers to attacker-controlled domains immediately after a search page load.

Detection Strategies

Deploy web application firewall rules that inspect the search_condition parameter for HTML tags, event handlers, and JavaScript URI schemes.
Enable WordPress audit logging to record all administrator sessions and correlate anomalous session activity with recent link clicks.
Use browser Content Security Policy (CSP) violation reporting to surface inline script execution attempts on pages rendered by Car Demon.

Monitoring Recommendations

Monitor NGINX or Apache logs for repeated requests to Car Demon search URLs from a single source with encoded payloads.
Alert on WordPress administrator account changes, plugin installations, or user creations that follow unusual referrer patterns.
Track outbound DNS queries from workstations that recently accessed the vulnerable WordPress site.

How to Mitigate CVE-2024-13334

Immediate Actions Required

Deactivate the Car Demon plugin on all WordPress instances until a patched release is confirmed by the vendor.
Audit administrator and editor accounts for unauthorized changes and rotate credentials for accounts that may have visited crafted links.
Deploy WAF signatures blocking XSS payload patterns targeting the search_condition parameter.
Invalidate active WordPress sessions and force re-authentication for privileged users.

Patch Information

At the time of publication, no fixed version beyond 1.8.1 is referenced in the NVD entry. Site operators should monitor the Wordfence Vulnerability Intelligence advisory and the WordPress Plugin Directory for a security update and apply it immediately once available.

Workarounds

Remove or disable the Car Demon plugin until an official patch is released.
Implement a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce payload execution.
Add server-level rewrite rules that reject requests containing HTML tags or JavaScript keywords in the search_condition parameter.
Restrict access to the vulnerable search endpoint via IP allowlisting where feasible.

bash

# Example ModSecurity rule blocking XSS payloads in search_condition
SecRule ARGS:search_condition "@rx (?i)(<script|javascript:|onerror=|onload=|<iframe)" \
    "id:1013334,\
     phase:2,\
     deny,\
     status:403,\
     msg:'CVE-2024-13334 Car Demon XSS attempt blocked',\
     logdata:'Payload: %{MATCHED_VAR}'"